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26 October 1981 


MEMORANDUM FOR: Deputy Director of Security (PTAS) 


FROM: eT F 
left of Operations (PTAS) 


SUBJECT: Comments - Unannounced Security Audit Policy 


1. As I remember the historical facts, the then DCI--after 
Boyce-Lee--felt that the industrial contractors involved with 
national programs were at best very cavalier in their "put into 
effect acceptance" of Agency contract securi dards. I 
believe he felt that the Boyce-Lee exposure especially STAT 
after the first Security team's audit report, proved the fact 
and was reason enough to exact some type of punitive measures. 

At any rate, it was at his direction that the unannounced policy 
was put into effect and, as I remember, we tried to adhere to 

it religiously, even to the point of receiving some really merited 
criticism from industrial leaders. 


2. After the initial flurry subsided, what appeared to be 
a contradictory situation arose. On the one hand, efforts were 
made to repair the ClIA-contractor relationship, a part of which 
was to bring the two security interests closer together. Eventually 
this went as far as--during the APEX era--to make corporate security 
an equal partner, to the extent that to some few it appeared that 
corporate security was dictating APEX security policies. On the 
other hand, there was really no change in the unannounced inspection 
policy. 


3. I am persuaded that] analysis is correct. A 
change from the unannounced inspection procedure would be beneficial 
overall and any loss would be extremely minimal. Even if corporate 
security used the few days prior to the inspection to correct 
security deficiencies, this would be all to the good as improved 
security is our real intention. At any rate, our industrial audit 
teams are now quite experienced in the audit function and I feel 
sure would be sharp enough to realize what had occurred, thus could 
use this knowledge to reinforce thérough, subtle challenge that 
we expect enhancementg to take place as it becomes necessary, not 
just before arrival of the CIA audit team. 
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4. I feel that we should change the policy, with gne proviso 
that we retain the option to conduct unannounced audits where we-™ 
see a particular contractor consistently resisting our security 
standards and being dishonest or not above-board in their dealings 
with our security and contracting officers. In my estimation, there 
would be little need to exercise the option as I believe there is 
now a mutuality of respect between CIA Security and our contractors. 
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